Frontend fork of Zitadel
- TypeScript 94.7%
- Go 2.4%
- JavaScript 2.2%
- Shell 0.5%
- SCSS 0.1%
| Filename | Latest commit message | Latest commit date |
|---|---|---|
Maël Gramain
d101958f68
All checks were successful
ci/woodpecker/push/docker Pipeline was successful
Passkey login on idp.gnous.eu failed with `[failed_precondition] Session
sans challenge WebAuthN (COMMAND-Ioqu5)` whenever the login name was typed
with different casing than the stored one -- `mael@gnous.Eu` against a
canonical `mael@gnous.eu` was enough.
The `GnousEU` org has `ignoreUnknownUsernames` enabled. sendLoginname
therefore does two things: it skips creating a session, and it forwards the
string the user typed into the next step's URL rather than the account's
preferredLoginName. Both are deliberate -- echoing the canonical name back
would leak whether the account exists.
So the /passkey page carries the typed name, and the two requests that make
up a passkey login resolve their session through it:
challenge request -> no cookie yet -> creates session A, stores the cookie
under the canonical name ZITADEL returned
verify request -> looks A up by the *typed* name -> `===` misses ->
creates session B, which has no WebAuthN challenge
Confirmed in the eventstore -- two sessions, same user and fingerprint, two
seconds apart, only the first carrying `session.webAuthN.challenged`:
391709887156977667 session.added + session.webAuthN.challenged 06:48:06
391709890260762627 session.added (no challenge) 06:48:08
ZITADEL treats login names case-insensitively, so these lookups must too.
Password login hid the defect: its check carries no cross-request state, so
a freshly forked session verifies just fine. Passkeys are the only flow that
needs the challenge to still be on the session found by the next request.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
||
| .woodpecker | ||
| acceptance | ||
| constants | ||
| dockerized | ||
| locales | ||
| public | ||
| screenshots | ||
| scripts | ||
| src | ||
| test-mocks | ||
| .gitignore | ||
| AGENTS.md | ||
| CLAUDE.md | ||
| Dockerfile | ||
| eslint.config.mjs | ||
| LICENSE | ||
| next-env-vars.d.ts | ||
| next-env.d.ts | ||
| next.config.mjs | ||
| package.json | ||
| postcss.config.cjs | ||
| prettier.config.mjs | ||
| project.json | ||
| tailwind.config.mjs | ||
| test-setup.ts | ||
| test-theme.js | ||
| THEME_ARCHITECTURE.md | ||
| THEME_CUSTOMIZATION.md | ||
| tsconfig.json | ||
| vercel.json | ||
| vitest.config.dockerized.ts | ||
| vitest.config.ts | ||